1

Is there any easy way by using windbg/ollydbg to figure out a memory range or simply an address is DEP-enabled or not?

1

For your case all "DEP enabled" for a process means is that the stack and heap are not writable and executable. By the time you can attach a debugger you just need to check if the stack and heap are ReadWrite or ReadWriteExecute.

In Windbg you can use either !vprot or !address to get this information. In Olly I believe there's a window under view that will give you a list of the memory regions in a process and their associated protections.

Additionally you can check the PE header of an executable to see if it supports DEP or not. The mona plugin gives you a quick command to see this, but there are probably others as well.

2
  • 1
    stack and heap are not the only regions covered by DEP. It's simply that any page in the process space is either executable or it's not, assuming that DEP is enabled for the process at all. – peter ferrie Jan 31 '16 at 17:43
  • Yes, you're right, but for the case that most people would be talking about the stack and heap are all that they really care about. – Fewmitz Jan 31 '16 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.